Yes, the body of a shipment notification can name the medication, provided the message is sent through a secure channel handled only by vendors under a business associate agreement (BAA). The subject line, preview text and tracking page should not name it.